As computer systems and associated networks become more ubiquitous and complex, as the sensitivity of the content of the systems and network increases, and as the conventional user access paradigms changes for organizations of all types and sizes, from main offices or workplaces having dedicated IT systems to decentralized networks of IT servers and the like, system security rapidly becomes a major concern. Where secure access is required for individuals in a multi-user environment, security and identity verification and management become more important in maintaining system and network security and data integrity.
In view of these concerns, conventional computer systems and associated networks include a server that acts as a certificate authority for authenticating users. Particularly, the server issues certificates to the users after successful performance of an authentication process, which involves the user presenting a token, such as universal serial bus (USB) tokens, smartcards or the like, to the server via a client device such as a host computer. The token is generally accepted as an integral part of a two-factor security paradigm in which possession of the token is the first factor and authentication of the holder of the token is the second factor. The token includes a key that is used by the token to generate a digital signature, which is presented to the server. The server acting as the certificate authority issues a certificate to the token if the digital signature is valid.
Problems can arise when, for example, a user of a token inadvertently or even intentionally reveals the token's key to a third party such as a process running in the multi-user processing environment including unauthorized or malicious processes. These processes can than generate a digital signature based upon the key obtained from the token, thereby deceiving the server acting as the certificate authority into improperly issuing a certificate. Accordingly, the certificate authority may not be able to obtain a level of trust needed to issue higher levels of privileges to a particular token because the certificate authority is unable to verify that the digital signature was generated by the token rather than by an unauthorized or malicious process that has gained access to the key.
Therefore it would be desirable for a solution to facilitate a server to verify that a digital signature was actually generated at a specific token rather than by an unauthorized or malicious process in order to give higher levels of privileges to the specific token. In addition, factors such as scalability, standards compliance, regulatory compliance, security administration and the like must also be taken into consideration.
While a general background including problems in the art are described hereinabove, with occasional reference to related art or general concepts associated with the present invention, the above description is not intended to be limiting since the primary features of the present invention will be set forth in the description which follows. Some aspects of the present invention not specifically described herein may become obvious after a review of the attendant description, or may be learned by practice of the invention. Accordingly, it is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only in nature and are not restrictive of the scope or applicability of the present invention.